CVE-2026-30520Medium· 5.4▾ SunlitA Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input suppli…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
0.2% → 0.3%
A Blind SQL Injection vulnerability exists in SourceCodester Loan Management System v1.0. The vulnerability is located in the ajax.php file (specifically the save_loan action). The application fails to properly sanitize user input supplied to the "borrower_id" parameter in a POST request, allowing an authenticated attacker to inject malicious SQL commands.
loan_management_system = 1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-11601High· 7.3A vulnerability was detected in SourceCodester Online Student Result System 1.0
CVE-2025-13264Medium· 6.3A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0
CVE-2025-12929High· 7.3A flaw has been found in SourceCodester Survey Application System 1.0
CVE-2023-33677High· 7.5Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*".
CVE-2026-117516High· 7.3oretnom23 php-travel-agency-system Contact Form contact_insert.php sql injection
CVE-2026-117513High· 7.3oretnom23 php-travel-agency-system Admin Search Pages customer_search.php sql injection